AZ-104 Implement and Manage Virtual Networking Practice Question
Exhibit
Storage account: reportsa Public network access: Enabled Selected networks: none VM subnet: app-subnet Requirement notes: - Keep the storage account on its public endpoint. - Permit only workloads in app-subnet to reach the account. - Do not assign static public IP addresses to the VMs.
Based on the exhibit, which network feature should you use so only the subnet can reach the storage account while still using the public endpoint?
⚠ Common exam trap
Candidates often confuse service endpoints with private endpoints, thinking that only private endpoints can provide secure access, but service endpoints allow subnet-specific access while keeping the public endpoint enabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.
Enabling a service endpoint on the app-subnet allows traffic from that subnet to reach the storage account over the Azure backbone network while still using the public endpoint. By then adding the subnet to the storage account firewall, you restrict access to only that subnet, ensuring no other internet traffic can reach the storage account. This approach leverages the public endpoint but with subnet-level access control, meeting the requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a private endpoint and disable the storage account public endpoint.
Why it's wrong here
A private endpoint assigns the storage account a NIC in your VNet and routes all traffic to it over a private IP, which normally requires disabling the public endpoint for full effect. The exhibit's requirement explicitly states that the storage account must keep its public endpoint, so this is a direct violation of the stated constraint. Even if you kept the public endpoint enabled while adding a private endpoint, that would be an unnecessary architectural change and still would not be the subnet-based firewall rule requested by the scenario.
When this WOULD be correct
When the requirement is to ensure that only traffic from a specific subnet can access the storage account and the public endpoint must be disabled for security reasons, such as in a scenario where all access must go through Microsoft's backbone network to avoid internet exposure.
- ✓
Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.
Why this is correct
A service endpoint is the correct choice when you want the storage account to remain on its public endpoint but only allow traffic from a specific subnet. It extends the subnet identity to the service without requiring static public IP addresses on the VMs.
- ✗
Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.
Why it's wrong here
Adding a NAT gateway to app-subnet replaces the subnet's outbound source IP with the NAT gateway's static public IP, so you could hypothetically add that IP to the storage firewall. However, the scenario calls for granting access based on the subnet identity, not on a public IP, and NAT gateway does not integrate with the storage service's virtual network rules. It also introduces a separate public IP to manage and does not preserve the subnet-level authorization that a service endpoint provides.
When this WOULD be correct
If the question required all outbound traffic from app-subnet to use a single, static public IP for internet access (e.g., for whitelisting on external services), and the storage account allowed access via that specific public IP in its firewall rules, then a NAT gateway would be correct.
- ✗
Peer app-subnet with a new VNet and access the storage account through peering.
Why it's wrong here
VNet peering links two virtual networks so resources in each can communicate over the Azure backbone, but it does not alter how Azure Storage evaluates access. Unless the storage account is deployed into a VNet (which it is not in this exhibit), peering has no effect on the storage firewall, and the VM's source IP as seen by the service remains unchanged. Peering also cannot replace the need to configure a service endpoint or IP-based allow rule on the storage account.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-104 exam frequently reuses these exact scenarios with slightly different constraints.
✓Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.Correct answer▾
Why this is correct
A service endpoint is the correct choice when you want the storage account to remain on its public endpoint but only allow traffic from a specific subnet. It extends the subnet identity to the service without requiring static public IP addresses on the VMs.
✗Create a private endpoint and disable the storage account public endpoint.Wrong answer — click to see why▾
Why this is wrong here
The question requires using the public endpoint, but option A disables it, which violates the constraint.
★ When this WOULD be the correct answer
When the requirement is to ensure that only traffic from a specific subnet can access the storage account and the public endpoint must be disabled for security reasons, such as in a scenario where all access must go through Microsoft's backbone network to avoid internet exposure.
Why candidates choose this
Candidates may think that a private endpoint is the only way to restrict access to a specific subnet, overlooking that service endpoints can achieve similar restriction while keeping the public endpoint enabled.
✗Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.Wrong answer — click to see why▾
Why this is wrong here
A NAT gateway provides outbound internet access with a static public IP, but it does not restrict access to the storage account's public endpoint from only the subnet. The storage firewall cannot filter by NAT public IP in this way; it requires service endpoints or private endpoints for subnet-level access.
★ When this WOULD be the correct answer
If the question required all outbound traffic from app-subnet to use a single, static public IP for internet access (e.g., for whitelisting on external services), and the storage account allowed access via that specific public IP in its firewall rules, then a NAT gateway would be correct.
Why candidates choose this
Candidates may think that using a NAT gateway's public IP in the storage firewall can restrict access to the subnet, confusing outbound source NAT with inbound access control, or they may overestimate the firewall's ability to filter by NAT IPs.
Analysis generated from the official AZ-104blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Go deeper
Related to this question
Learn chapter
Managed Identities for Azure Resources
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
Key term
Service endpoint
A service endpoint is a specific network address (URL or IP/port) that client applications use to access the functionality or data of a cloud or web service.
About these practice questions
This AZ-104 question is part of Courseiva's 1,049-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-104 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-104 exam.